If an AWS service control policy allows an action, can users in that account perform it?

Many candidates hear "policy that allows" and assume it works like an IAM allow. In AWS Organizations it does not, and getting this wrong leads to either false confidence or lockouts.

A ceiling, not a grant

The AWS documentation is explicit: SCPs "do not grant permissions" and define "a permission guardrail, or sets limits, on the actions that the IAM users and IAM roles in your organization can perform." To actually perform an action, a principal needs an identity-based or resource-based policy that grants it and every SCP above the account must allow it. A user with no IAM policy has no access even if the SCPs allow everything.

What SCPs do not cover

SCPs affect only member accounts. They have no effect on users or roles in the management account, and they do not restrict service-linked roles. They also do not apply to principals from accounts outside the organization, such as an outside account reached through a bucket policy. That is why the management account should hold as little as possible.

Operational gotcha

AWS recommends testing before attaching an SCP at the organization root, using an OU and moving accounts in gradually. Removing the default FullAWSAccess policy without a replacement causes all actions from member accounts to fail.

Why the distractors are tempting

"SCPs grant access" mixes them up with IAM allow statements. "Only the root user" and "only the management account" invert the real scope.

What interviewers want

"A ceiling, not a grant — effective permissions are the intersection," plus the management-account and service-linked-role exceptions.